How to distinguish between creating a reparse point and opening a reparse point file by a filter dri

NTFSD
1

Probably only Microsoft folks can answer this question.
My file system filter driver is designed to take actions for opening an
existing reparse point file.
But now I found that when an user mode program calls DeviceIoControl with
FSCTL_SET_REPARSE_POINT to convert a normal file to a reparse point file, my
filter driver receives the same request as an existing reparse point file is
opened.
I guess the DeviceIoControl with FSCTL_SET_REPARSE_POINT internally calls
ZwCreateFile to make the conversion.
Is there any flag in the IRP by which my filter driver can distinguish the
different requests?

Thanks and regards,

Shangwu

2

I believe what you are seeing only occurs when setting a mount point
reparse point (reparse tag == IO_REPARSE_TAG_MOUNT_POINT). NTFS opens
the target of this mount point to verify that it is a valid path.

You can distinguish this create from other creates you may see in two
ways:

  1. The RequestorMode in the IRP will be KernelMode, since Ntfs generated
    the CREATE.
  2. The return value of IoGetTopLevelIrp() will be non-NULL since this is
    a recursive operation from the file system.

Thanks,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu
Sent: Tuesday, February 17, 2004 2:35 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] How to distinguish between creating a reparse point and
opening a reparse point file by a filter driver

Probably only Microsoft folks can answer this question.
My file system filter driver is designed to take actions for opening an
existing reparse point file.
But now I found that when an user mode program calls DeviceIoControl
with FSCTL_SET_REPARSE_POINT to convert a normal file to a reparse point
file, my filter driver receives the same request as an existing reparse
point file is opened.
I guess the DeviceIoControl with FSCTL_SET_REPARSE_POINT internally
calls ZwCreateFile to make the conversion.
Is there any flag in the IRP by which my filter driver can distinguish
the different requests?

Thanks and regards,

Shangwu

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Hi Molly,

Thank you for your reply. My case is not related to the reparse point of
mount point. Our program creates reparse points with our specific tag. But I
think your suggestion is very important. I will try both of them.

Regards,

Shangwu

“Molly Brown” wrote in message
news:xxxxx@ntfsd…
I believe what you are seeing only occurs when setting a mount point
reparse point (reparse tag == IO_REPARSE_TAG_MOUNT_POINT). NTFS opens
the target of this mount point to verify that it is a valid path.

You can distinguish this create from other creates you may see in two
ways:

1. The RequestorMode in the IRP will be KernelMode, since Ntfs generated
the CREATE.
2. The return value of IoGetTopLevelIrp() will be non-NULL since this is
a recursive operation from the file system.

Thanks,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu
Sent: Tuesday, February 17, 2004 2:35 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] How to distinguish between creating a reparse point and
opening a reparse point file by a filter driver

Probably only Microsoft folks can answer this question.
My file system filter driver is designed to take actions for opening an
existing reparse point file.
But now I found that when an user mode program calls DeviceIoControl
with FSCTL_SET_REPARSE_POINT to convert a normal file to a reparse point
file, my filter driver receives the same request as an existing reparse
point file is opened.
I guess the DeviceIoControl with FSCTL_SET_REPARSE_POINT internally
calls ZwCreateFile to make the conversion.
Is there any flag in the IRP by which my filter driver can distinguish
the different requests?

Thanks and regards,

Shangwu

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com